Of all the things that this week’s attack on the Westgate Mall in Nairobi was- horrific, tragic, inhuman, revolting- one thing it wasn’t was a surprise, either in terms of location or tactics.

Security observers have been warning about the threat of a high-profile terror attack in Kenya’s capital for years. Since the disastrous US embassy bombing of 1998, travel to Nairobi has always been accompanied by a warning that Islamist militants may attempt to stage a similar event. Targets of choice for terrorist attacks are those most likely to garner widespread international attention: High-end hotels, embassies, international organizations, tourist hotspots, and places where foreigners and wealthy locals gather, like restaurants and malls.

In mid-2012 I had lunch with a Rwandan friend at Onami, a Japanese restaurant upstairs in the Westgate complex, overlooking the carpark out front. He was working for our Somalia office, and I had recently been to Somalia myself, so the threat posed by al Shabaab was something both of us thought about regularly. Leaving the shopping mall after a pleasant lunch, we discussed Westgate’s security vulnerabilities. As we drove down the ramp that is the mall’s side vehicle entrance, I pointed to the security booth by the boom-gate, manned by a couple of unarmed security guards waving mirrors under entering vehicles.

“A small team of gunmen with AKs would make short work of that,” I observed, and he nodded.

On Saturday, that’s just what they did.

Nobody with a concern for security would have failed to note the shortcomings of Westgate. A couple of dozen private security personnel, mostly armed with nothing more than nightsticks. A boom gate around the side. A massive parking-lot facing the plate-glass frontage- which a small car-bomb would turn into deadly shrapnel. A couple of guys with wands searching handbags and backpacks as you come in the doors. It stood out sharply to the Nairobi I’m more familiar with. I’ve been coming to Kenya since 2001. I still recall walking through the Sarit Centre (Westlands’ main upmarket shopping mall before Westgate was opened) and seeing four uniformed squaddies on their routine patrol, each of them brandishing what looked like PKM light machine-guns, muzzles practically dragging on the poured cement floor. Walking through an Uchumi supermarket at another centre, I remember a paramilitary policeman perousing the aisles, casually swinging an Uzi by its magazine as though it were nothing more than a baton. Well-armed security was everywhere in those days, a response to Nairobbery’s skyrocketing crime rate.

Nairobi’s improved crime situation over recent years is partly to account for the shift away from heavy-handed visible security forces- together with improvements in counter-terrorism intelligence and the quality of reaction forces. None the less, even in 2012 the low security at Westgate exemplified the term ‘soft target’, and whenever I gave security briefings to Nairobi-bound travellers, Westgate was listed among the places I mentioned as possible targets for a terrorist attack, which I described as ‘unlikely to happen during the short time you’re there, but it could still happen’.

Al Shabaab have been threatening a major terrorist attack in Nairobi ever since the Kenyans invaded southern Somalia in late 2011, ostensibly in support of the Africa Union mission to stabilize Somalia and wipe out the indigenous hardline militia that at various times controlled much of the south of the nation. Even prior to that, and in part precipitating the Kenyan invasion, al Shabaab have been feared to pose a threat to Kenyan domestic security. However all that we’ve seen since that time until now is a series of low-impact, low-profile attacks that have mostly focused on security forces in the north-east of Kenya. These have been primarily grenade and IED attacks, with some shooting incidents as well. Grenades have been thrown in Nairobi and Mombasa, targeting bars, churches and public transportation. A day or two after I had lunch with my friend at Westgate, a small IED went off in downtown Nairobi, but the impact was minimal. Although people were cautious for a few days afterwards, it had no discernible impact on the Kenyan psyche or in promoting terror. In all, a couple of dozen civilians have lost their lives over the last few years.

Analysts gave a good reason why that was the case. Nairobi is home to a massive Somali diaspora. For many years, Somalia’s government in exile was based in Nairobi. Shabaab too has supporters in Nairobi- in significant numbers. The general agreement has been that most of the terror attacks in Nairobi and Mombasa were not so much al Shabaab-initiated attacks, but rather were attacks by al Shabaab sympathisers using their own resources and initiative, which the Shabaab was happy to claim for its own propaganda purposes.

This Somali diaspora has traditionally been one of the most stable elements of support for al Shabaab. They provide funding, raised through legitimate trade and business, and returned to Somalia via remittances. The Somali diaspora worldwide supposedly provides more remittances than any other group of diaspora. Were al Shabaab to carry out a major attack on Kenyan soil, two things were likely to happen. First, the Kenyan government would crack down on the Somali population in Nairobi- arrests, surveillance, and likely vigilante violence as well. Second, the Kenyan government would increase restrictions around Somali businesses sending money back to Somalia. Making Nairobi Somalis suffer for an al Shabaab attack would decrease sympathy for the movement, and also cut one of the al Shabaab’s most lucrative funding sources.

For this reason, a state of tense stability remained within the security context. It was generally accepted that a major al Shabaab attack was possible but unlikely, because by carrying out such an attack, al Shabaab would be shooting themselves in the foot.

Unless, of course, it was a last resort and they had little to lose by trying.

Three things have happened over the last 12 months that should have put up red flags in security monitoring circles that have shifted the nature of this dynamic. The first is that with improved safety and stability in Mogadishu (everything relative), large numbers of Nairobi Somalis have been returning to Mogadishu, and re-establishing their businesses in Somalia instead. Eastleigh- the main Somali neighbourhood in Nairobi- has reportedly seen a large outmigration of both people and businesses, and the Kenyan government has actively encouraged this, as it has long seen the Somalis in Kenya as a security risk. In this way, Nairobi has decreased in importance as a support hub for al Shabaab (although it’s not altogether negated).

The second is that al Shabaab have been consistently and steadily losing operational control of territory. This started in earnest (again) in 2011. While the loss of key holdings like Kismayo, Baidoa and other urban centres is claimed as blow against al Shabaab, as a militant group their real strength lies in the support of the people themselves. However in much of Somalia, they have been gradually losing a sense of legitimacy, due in large part due to their perceived brutality. An effort to re-brand themselves as an Al Qaeda subsidiary, together with an influx of foreigners that picked up since 2009, has strengthened their hardline core, but alienated them even from their core supporter base in Mogadishu, in Bay-Bakool and other al Shabaab heartland areas (and even al Qaeda have been lukewarm in embracing what is still essentially a locally-focused and peroquial extremist militia).

The third thing that has happened- a side-effect of the second- is a leadership struggle that has pitted certain hardline elements against a number of more moderate voices. This culminated less than two weeks ago in the killing of two prominent foreign jihadis who had grown increasingly critical of the al Shabaab leadership.

Al Shabaab now finds itself in a precarious position. They have a leadership that is new and not supported by all elements of the organization. They continue to lose territory and support at home in Somalia and support from abroad. And their supporter base in Nairobi has diminished.

At this point in time, hindsight lets us observe that perhaps the security context had shifted significantly.

Whether the Nairobi attack is directly due to the establishment of new hardline leadership is currently a matter for speculation. The current leadership has been consolidating itself over several months, although the elimination of some of the dissenting voices is much more recent. The planning-cycle for a large-scale terror attack is typically measured in months, or longer if it is highly complex. Whether this attack has been in the works for many months and has been on standby waiting for the right trigger, or whether it has gone swiftly from planning to execution isn’t currently known. None the less, an event like the Westgate attack serves several purposes. It demonstrates to al Shabaab itself that the new leadership are competent and in control. It panders to the hardline cadre. Al Shabaab are in a situation now where things really can’t get much worse for them, so they have nothing left to lose- the risk is worth it. And if the Kenyans respond by cracking down on the Somali diaspora still in Nairobi, al Shabaab may win a second victory by increasing Somali resentment in the face of a new round of Kenyan brutality.

There are other indicators that suggest, contrary to some observations, this attack is a sign of al Shabaab’s weakness, not its strength. First, the tactics used. Terror attacks can take a number of forms, the most spectacular and shocking generally involving large bombs- like the ones used in the Nairobi and Dar-es-Salaam Embassy Bombings. In fact the Westgate shopping mall leant itself perfectly to a bombing. Its plate-glass frontage would, in the event of a large explosion, turn into deadly shrapnel, killing and maiming in great numbers.

That al Shabaab did not use this tactic is something we should be grateful for. The fact they didn’t tells us a lot about their capacity. Bombs are hard. They take raw materials to make the bomb (which are monitored for by counter-terrorism forces), and a specialised skill-set is required for a bomb-maker. They take months to plan, prepare and prime, and they are easy to mess up. Poor techniques in mixing, assembling, priming or triggering the explosive, and months of work can be lost- and a highly skilled asset exposed. On top of that, the counter-intelligence required to maintain secrecy for such a project is significant. It takes a robust organization with resources to spare in order to carry out this sort of attack outside an area under its operational control. Al Shabaab did not avoid this tactic because they wanted to avoid spectacle or had no stomach for the loss of life. They avoided it because they did not have the capacity.

Instead they went with a couple of groups of gunmen with grenades and automatic rifles. Both weapon sets are quickly, cheaply and easily obtained in Kenya, with its large proliferation of small-arms and highly militarized and easily-permeated northern borders. As for the personnel, it’s not yet clear whether they were smuggled in from Somalia or home-grown Nairobi Somalis mobilized for the job. The former is the more likely suggestion, because all indications suggest they were at least somewhat trained and battle-hardened, under al Shabaab operation control while in the mall, and because mobilizing inexperienced Nairobi Somalis would be a riskier proposition in terms of mission compromise and in terms of being able to execute the mission. Regardless, moving a dozen personnel from Somalia to Kenya, while carrying an element of risk and cost, is not a major operational difficulty.

In short, the tactics used are highly effective to purpose, but the cheap option. Indicators that al Shabaab have limited resources and capacity.

A second hallmark of terror attacks today is the use of multi-tiered attacks. The combination of a bomb-blast and then a secondary device to target evacuees or rescuers; of a bomb-blast followed by a team of gunmen who use the chaos to enter and cause more harm; or of simultaneous attacks.

The Westgate attack was an extremely simple affair. Two teams of fighters with weapons and grenades, dropped off by cars, entering a very poorly guarded target. There was no complexity. There was little tactical challenge. There was no primary device. A friend who was in the Sarit Centre, about a kilometre away, when the attack began, said he heard the grenades and then automatic fire begin in the distance, and immediately went to cover with his companions, knowing that a standard protocol is for two targets to be hit simultaneously. The Sarit Centre, still an expatriate hub, would have been an easy second target for a second team, and would have increased the chaos and fear quotient significantly, splitting Kenya’s response units and strangling a major economic hub of the city for days. Any Shabaab mission planner would have known this. Again the fact that Shabaab did not do this indicates their capacity to carry out foreign attacks is extremely limited.

Far from spreading fear that al Shabaab is on the ascendency, the Westgate attack should be seen as a last-ditch attempt by an ailing group to bolster its own internal networks, and hope to trigger a negative backlash against Somalis in Kenya who might then become renewed Shabaab sympathisers. It’s a desperate move, one that suggests they have very limited resources, and hopefully one that’s unlikely to be repeated in a hurry- if not for a lack of will then for a lack of resources and opportunity.

Two caveats. A negative backlash against Somalis in Kenya would almost certainly play into Shabaab’s hand and strengthen their position. Somali communities in Kenya have already spoken out against the attack and indicated solidarity with Nairobi citizens in condemning al Shabaab’s tactics. Kenya’s authorities should now move to ensure that Somalis are protected from a vigilante backlash, and do not themselves take their anger out on Kenya’s Somali population in frustration.

The second is that just because al Shabaab’s capacity to attack overseas is weak, it does not mean that Somalia’s Islamist militancy is about to be overthrown. Whether al Shabaab as an organization continues to exist in a meaningful tactical sense over the next two to three years remains to be seen. However the militant and extremist interpretation of Islam that al Shabaab embraces is reflective of a large portion of rural south-central Somalia, and has been a part of the security landscape in Somalia since the mid-90s in one form or another. Al Shabaab is a home-grown militant network that is simply the latest embodiment of an attitude that is found deep in the population. As long as south-central Somalis feel disempowered by clan politics, an illegitimate central government, or foreign occupying forces, there will be extremists who will use IEDs, suicide attacks and ambushes against both military and civilian targets to get their point across, and there will be outside elements who will further take advantage of this disenfranchisement for their own purposes. Instability in south central Somalia is, unfortunately, here for the long-haul.

Early days Buku. A lot of the assertions e.g. re: foreign attackers etc. will become clear over the next few days/weeks. We’re still very much under fog-of-war conditions, so I can’t speculate further. I don’t doubt that Hamas would be happy to target Israeli interests, so a motive hangs true. Iranian agents were picked up in Kenya some months back planning attacks- Hamas is an Iranian vessel. But everything beyond that point is conjecture with respect to Westgate. I would say that Hamas is pretty tied up with what is going on in Syria & Lebanon right now, as is Iran, and I doubt they have the resources or the inclination to invest in launching attacks on other fronts. Time will tell, I guess, but I’d be sceptical for now about stretching this too much further than AS based on what we’ve seen so far.

The speculation is based on survivor accounts. One survivor, a Kenyan of Indian origin, complained to the press that one of the people escorted to freedom was one of the attackers whom he personally saw change clothes. He alerted the Police, but they did not take him seriously. This Kenyan of Indian origin said that the person was Arab, not Somali.
A second witness who played possum to survive after he was shot at (and grazed by bullets) said that the attackers wore scarfs similar to the ones used by Yasser Arafat. The second witness was an African.

The account of the witness of Indian origin is extremely noteworthy because Indians look more like Persians than Arabs, and so he most likely gave a fairly accurate description of the attacker in describing him as Arab looking. You combine that with independent witness claims of the attackers wearing scarfs that looked like those used by Arafat, and then you see that, quite like the title of your article, Al Shabab was more likely a mere mouth piece, incapable of launching bombs at Kenyans – Iranians (and Hezbollah) look more like Persians. The Arab looking people are more likely to be Hamas – mostly Sunni moslems with roots in Saudi Arabia.

Hamas using human shields is a classic strategy they use when fighting Israel – they probably supervised the begining of the attack – explaining its ferocity, and then betrayed their fellow, non-core Hamas fighters and fled, hoping that they all die in the firefight to hide any possible evidence.

Re: eyewitness accounts- okay, maybe. Eyewitness accounts are notoriously unreliable in high-intensity situations, but there’s certainly a lot of chatter that there were a range of foreign operatives involved in the attack. Time will tell whether or not this is the case. Al Shabaab does recruit foreigners and have foreigners among their cadres, and non-Somalis would have been easier to infiltrate Kenya, so I don’t think this is definitive of a Hamas link by any stretch. Since 2009/10 al Shabaab has had in increasing number of Arabs and other foreigners coming in, and these have been the hardliners pushing more of a foreign-focused agenda and more radical violence, so again this isn’t a big surprise that they would be involved if it were an al Shabaab attack.

The checkered headscarf you refer to is called a keffiyeh. It was originally a symbol of solidarity and resistance on behalf of Palestinians, but has since become both a fashion statement and a general statement of political resistance all around the world. Again, that militant fighters might wear keffiyehs is neither surprising, nor in any way conclusive to Hamas, who do not have the monopoly on keffiyeh-wearing gunmen.

The human-shield strategy likewise goes well beyond Hamas. The tactics used in Westgate are now hallmarks of global terror operations. A similar tactic of holding complex buildings or areas with large numbers of trapped civilians has been used by terrorists in Kabul, in the Mumbai terror attacks, and most recently in the attack in Algeria- a very diverse set of examples. Westgate was pretty much a textbook generic tactical approach that any terrorist planner would have and could have come up with.

None of this says that Hamas wasn’t involved in Westgate. But at this time, everything you’ve listed is perfectly in line with al Shabaab’s operational reality, and the simpler, more logical explanation is that al Shabaab operatives (possibly with foreign backing, support or urging) planned and carried out the attack in line with their own agenda. Certainly multiple terror groups will see Westgate as a victory and in line with their own goals, Hamas possibly included, but this doesn’t mean they were involved.

Well, even the behaviour of the terrorists suggests that they were not Al Shabab or Al Quaeda. Al Shabab and Al Quaeda are typically suicide bombers. These terrorists
i)took hostages – a tactic that is not traditionally used by Al Quaeda or Al Shabab.
ii)when cornered, rather than commit suicide, 11 of the sixteen surrendered. Constant suicide attacks in Mogadishu (and the suicide bombers who killed 78 Christians in Pakistan over the weekend) is more typical of Al Shabab/Al Quaeda behaviour.

With regards to these attacks, Al Shabab is simply a rag-tag army that, with the help of the actual planners, as a mouth piece, is trying to create a larger-than-life impression after the serious losses and internal discord it is suffering in Somalia. Even on Twitter, it is obvious that there is still internal discord in Al Shabab. One tweeter obviously affiliated to Al Shabab announced a KDF soldier’s death before the Government made it official. He tweeted that people should ignore reports of a list of foreign fighters on another Tweeter account, claiming that he was the sole spokesperson for Al Shabab. However, the Kenya Government has all but confirmed that there were foreign fighters involved, suggesting that the second Tweeter account the first Al Shabab tweeter was telling people to ignore was also information from a valid source. These shows competing interests within Al Shabab.

It is unlikely that a group of people with such confilcting interests, also killing each other for control of Al Shabab in Somalia( even killing ‘The American’ just as recently as September the 1st,) would have had the level of sophistication to even rent a store in the mall for over a month before the attack, as has now been suggested.

It is instructive to note that the Government of Kenya has suggested that it was Al Quaeda, not Shabab, responsible for the attacks. However, the modus operandi that excluded suicide bombings suggests to me that not even Al Quaeda was involved in the planning.

I just wanted to add that I do not agree with your observation that there was too much confusion to distinguish between an Arab and a Persian by an Indian(Indians look more Persian than Arab.) I highly doubt that, in a shootout, you, as a white person, would have difficulty between distinguishing between a Caucasian and a Persian or an Oriental, especially if you register in your mind that the person was first shooting people, then you observed the person changing clothes to blend into the crowd. It may surprise you that Koreans and Chinese can distinguish one from another just from facial features, whereas most other races have a problem distinguishing them. Had only the African witness suggested the use of keffiyehs, then there would be doubt on the race of the person. However, when we have a Kenyan of Asian origin say the same thing, then it becomes clearer that they were referring to a person of a specific race, of specific characteristics, that were not consistent with the features typical with Somali people.